CVE-2015-1239

Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in...

6.5 MediumFix available

Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.04%Down 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

Record: CVE-2015-1239
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-415
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-1239
Updated: 2026-11-02

EUVDEUVD-2015-1380 No score

Record: EUVD-2015-1380
Updated: 2026-11-03

GitHub AdvisoriesGHSA-935h-fp8w-9vph 6.5

Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in...

Record: GHSA-935h-fp8w-9vph
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-415
Updated: 2026-11-02

OSV 6.5

Record: CVE-2015-1239
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-1239 6.5

Record: DEBIAN-CVE-2015-1239
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-1239 6.5

Record: UBUNTU-CVE-2015-1239
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVSUSE-SU-2018:1364-1 No score

Security update for openjpeg2

This update for openjpeg2 fixes the following security issues:

CVE-2015-1239: A double free vulnerability in the j2k_read_ppm_v3 function allowed remote attackers to cause a denial of service (crash) (bsc#1066713)
CVE-2017-17479: A stack-based buffer overflow in the pgxtoimage function in jpwl/convert.c could crash the converter. (bsc#1072125)
CVE-2017-17480: A stack-based buffer overflow in the pgxtovolume function in jp3d/convert.c could crash the converter. (bsc#1072124)

Record: SUSE-SU-2018:1364-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`openjpeg2` Debian:12	before 2.1.1-1	2.1.1-1
`openjpeg2` Debian:13	before 2.1.1-1	2.1.1-1
`openjpeg2` Debian:14	before 2.1.1-1	2.1.1-1
`openjpeg2` Debian:8 From an advisory covering 2 CVEs	before 2.1.0-2+deb8u4, plus listed versions 2.1.0-22.1.0-2+deb8u12.1.0-2+deb8u22.1.0-2+deb8u3	2.1.0-2+deb8u4
`openjpeg2` SUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 3 CVEs	before 2.1.0-4.9.1	2.1.0-4.9.1
`openjpeg2` SUSE:Linux Enterprise Server 12 SP3 From an advisory covering 3 CVEs	before 2.1.0-4.9.1	2.1.0-4.9.1
`openjpeg2` SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 3 CVEs	before 2.1.0-4.9.1	2.1.0-4.9.1
`openjpeg2` Ubuntu:16.04:LTS	before 2.1.2-1.1+deb9u2build0.1, plus listed versions 2.1.0-2.12.1.0-2.1ubuntu0.1	2.1.2-1.1+deb9u2build0.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1239 is a medium vulnerability (CVSS 6.5) in Google Chrome, published October 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.04%, the 64th percentile. Fixed in openjpeg2 2.1.1-1.

References

Show 11 moreShow less